What we process
Account data: name and email address of you and your team members; name, address, phone number, website, country, time zone and language of your business; your settings and review sites. We first receive team members' data from the person who invites them.
Contract and payment data: plan, term, invoices, credit purchases and payment status. You enter card details directly with our payment service Stripe. We receive from Stripe the details we need for billing, but not the full card number.
Usage and technical data: IP address, browser and device type, pages visited and times, sign-ins and actions in the app, and details on the sending and delivery of messages.
Country of your IP address: when you sign up and when you visit, we look up the country of your IP address in a database on our own servers (IP Geolocation by DB-IP, db-ip.com, licensed under CC BY 4.0) to check that Citypicked is available in your country and to see where sign-ups and visits come from. For this we store only the country, and for refused sign-ups also a non-reversible hash of the address. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
Communication: your name, email address and the content of your messages when you write to us through the contact form, by email or in support.
Purposes and legal bases
Where the GDPR or the UK GDPR applies, we rely on the following legal bases. For the United Kingdom, the corresponding provisions of the UK GDPR apply.
To provide the service, run your account and sign-in, bill you and send you service emails (for example sign-in links, receipts, trial notices and notifications): to perform the contract and take steps before entering into it (Art. 6(1)(b) GDPR). If you act for a business that is our customer, we base the processing of your data on our legitimate interest in performing that contract (Art. 6(1)(f) GDPR).
To answer your messages to us: to perform a contract or take steps before entering into one (Art. 6(1)(b) GDPR), otherwise our legitimate interest (Art. 6(1)(f) GDPR).
To run the website and app securely, prevent misuse and fraud, enforce our terms and establish or defend legal claims: legitimate interest (Art. 6(1)(f) GDPR).
To analyze and improve our website and service, including by testing versions of our pages, and to inform customers about our services: legitimate interest (Art. 6(1)(f) GDPR).
To meet legal obligations, such as retention duties under tax and commercial law or requests from authorities: Art. 6(1)(c) GDPR. Where we ask for consent, consent is the basis (Art. 6(1)(a) GDPR).
Without an email address and the details needed for billing, we cannot create an account or run a subscription. Beyond that, you are not obliged to give us any data.
Cookies and analytics
We use no advertising cookies and no third-party analytics or tracking services. We use cookies needed to run the service, for example for sign-in, your chosen language, security and returning from checkout.
For our own analytics, we set a cookie with a random identifier that is kept for up to 12 months. With it we count visits, see which pages are used and test versions of our pages. We analyze this data ourselves. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
You can delete or block cookies in your browser at any time. The website works without the analytics cookie; without the necessary cookies you cannot sign in.
Recipients
Recipients of your data are our hosting company, Stripe for payments, email and SMS delivery services for sending, and other vendors who support us in running the service. They process the data on our behalf and on our instructions. Stripe also processes some payment data as a controller in its own right, for example to prevent fraud and meet legal obligations.
We also disclose data to authorities, courts and advisers where we are obliged to or where it is needed to establish or defend legal claims, and to an affiliate or a buyer if all or part of our business is transferred. Where the GDPR applies, the legal basis is then Art. 6(1)(c) or (f) GDPR.
If you follow a link from a review page to a review site, you leave our service. What the review site does with your data is governed by its own privacy policy.
International transfers
We are based in the United States and process personal data there and in other countries where our vendors operate. Where the GDPR or the UK GDPR requires safeguards for data that leaves the EU, the EEA or the United Kingdom, we rely on an adequacy decision, on appropriate safeguards, usually the European Commission's standard contractual clauses and the UK addendum to them, or on a statutory exception. You can request a copy of the safeguards at support@citypicked.com.
Retention
We keep data for as long as we need it for the purpose concerned. We keep account data for as long as the account exists. When an account is deleted, we delete its data after the period the app states at that point.
Records we must keep under tax or commercial law, such as invoices, are kept until the statutory period ends. Data we need to establish or defend claims is kept until those claims are time-barred.
Individual analytics data is kept for 13 months and only in aggregated form after that. Technical logs and contact requests are deleted once we no longer need them for security, troubleshooting or handling the request.
Data of our customers' customers is deleted according to the settings and instructions of the business concerned. If someone has unsubscribed, we keep the phone number or email address so that no further messages go to it.
Your rights in the EU, the EEA and the United Kingdom
Under the GDPR and the UK GDPR, where the legal conditions are met, you have the right of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time with effect for the future.
To exercise these rights, write to support@citypicked.com. We may ask for proof of your identity before we respond.
You can complain to a data protection supervisory authority, in particular in the country where you live or work or where the alleged infringement took place. In the United Kingdom, this is the Information Commissioner's Office (ICO).
Right to object
Where we process data based on our legitimate interest, you can object at any time on grounds relating to your particular situation. We then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
You can object to processing for direct marketing at any time without giving reasons, for example by email to support@citypicked.com. We then no longer use your data for that purpose.
Notice for California residents
To the extent the California Consumer Privacy Act (CCPA) applies to us, the following also applies to California residents. In the past 12 months we have collected these categories of personal information: identifiers (such as name, email address, IP address), commercial information (such as subscriptions and purchases), internet and other electronic network activity (such as use of the website and app) and professional information (such as your business). Sources, purposes, recipients and retention are described above.
We disclose this information for the business purposes described above to vendors who process it on our behalf. We do not sell personal information and do not share it for cross-context behavioral advertising (“sell” and “share” as defined in the CCPA), including that of people under 16. We do not use sensitive personal information for purposes that give rise to a right to limit.
Subject to the statutory exceptions, you have the right under the CCPA to know what personal information we process about you, and the rights to delete and correct it. We will not discriminate against you for exercising these rights. Submit requests by email to support@citypicked.com; we verify your identity first. An authorized agent may act for you if they prove their authorization.
We do not respond separately to browser “Do Not Track” signals, because we do no cross-site tracking and do not allow third parties to collect data about your activities on other websites through our website.
Other countries
If you live in another US state or another country with its own data protection law, such as Canada, the United Arab Emirates, Saudi Arabia, Qatar, Kuwait, Singapore or Japan, you have the rights that law gives you, to the extent it applies to us. To exercise them, write to support@citypicked.com.
Security
We protect data with appropriate technical and organizational measures against loss, misuse and unauthorized access. No system and no transmission over the internet is completely secure; we cannot promise absolute security.
Children
Citypicked is made for businesses. Our website and service are not meant for children, and we do not knowingly collect children's data for our own purposes.
Changes to this policy
We update this policy when our service or the law changes. The version published on this page applies. Last updated: November 3, 2026.